Contents
1 Who We Are
MNUC Market is operated by JBEE Creations, a technology business based in Juja, Kiambu County, Kenya. We run the online marketplace at mnuc-marketplace.netlify.app serving students, staff and community members around Mama Ngina University College.
Data Controller: JBEE Creations, Juja, Kiambu County, Kenya
Email: info@jbeecreations.co.ke ·
Phone: +254 716 356 483
2 Data We Collect
| Category | What we collect | Source |
|---|---|---|
| Account data | Full name, email address, profile photo | You or Google OAuth |
| Contact data | WhatsApp / phone number | You (optional) |
| Profile data | Course, year of study, user type (student/staff/external), referral source, bio | You (signup) |
| Listing data | Title, description, price, images, category, condition, location | You (when posting) |
| Payment data | M-Pesa phone number, transaction reference, amount | M-Pesa / Safaricom |
| Usage data | Pages visited, search terms, browser type, IP address | Automatically |
| Communications | Support messages, reports you submit | You |
We do not collect national ID numbers, bank account details, or precise GPS location beyond what you voluntarily include in listings.
3 Why We Collect It
- Running the marketplace — creating accounts, posting listings, search and browse
- Buyer-seller contact — displaying WhatsApp numbers on listings so buyers can reach sellers
- Account verification — distinguishing students, staff and external vendors for trust and safety
- Payments — processing M-Pesa listing fees and promotion charges
- Safety & moderation — detecting scams, enforcing rules, investigating reports
- Platform improvement — understanding which features are used most
- Legal compliance — meeting obligations under Kenyan law
4 Legal Basis (Kenya Data Protection Act 2019)
Under the Kenya Data Protection Act 2019 we process your data on the following bases:
- Contract performance — processing necessary to provide the service you signed up for
- Consent — where you have given clear consent (e.g. optional profile fields)
- Legitimate interests — platform safety, fraud prevention, and service improvement
- Legal obligation — where we are required to retain or disclose data by Kenyan law
5 Google Sign-In & OAuth
We offer Sign in with Google as a login option. When you use it:
- Google shares your name, email address, and profile photo with us.
- We do not receive your Google password.
- We do not access your Gmail, Google Drive, Google Contacts, or any other Google service.
- We only request the minimum OAuth scopes needed:
email,profile, andopenid. - Your Google data is stored in our Supabase database and used only to create and manage your MNUC Market account.
- You can revoke our access at any time at myaccount.google.com/permissions. Revoking access does not automatically delete your MNUC Market account — email us separately to request deletion.
6 Third-Party Data Processors
We use the following sub-processors. Each processes data only as necessary and is bound by their own privacy policy:
Supabase — Database & Authentication
Stores your account data, listings, messages and reviews. Servers are located in the EU (AWS eu-west-2). Supabase is SOC 2 compliant.
supabase.com/privacyCloudinary — Image Storage & Delivery
Stores and serves listing images and profile photos via their global CDN.
cloudinary.com/privacySafaricom M-Pesa — Payments
Processes mobile money payments for listing fees and promotions. Your M-Pesa phone number and transaction references are shared with Safaricom to complete payments.
Safaricom Privacy PolicyNetlify — Website Hosting
Hosts and serves the MNUC Market website. Netlify may collect standard server logs including IP addresses.
netlify.com/privacyGoogle — Sign-In / OAuth
Provides authentication when you choose "Sign in with Google". See Section 5 for full details.
policies.google.com/privacy7 Cookies & Local Storage
| Name / Type | Purpose | Duration |
|---|---|---|
| Supabase auth token | Keeps you logged in between pages | Session / 1 hour |
| cookie_consent | Remembers you accepted our cookie notice | 1 year (localStorage) |
| mnuc_saved_listing_ids | Stores your saved/wishlist listing IDs locally | Until cleared (localStorage) |
| wa_banner_dismissed | Remembers you dismissed the WhatsApp channel banner | Session (sessionStorage) |
We do not use advertising cookies, tracking pixels, or third-party analytics cookies. You can clear all local storage at any time through your browser settings.
8 Data Sharing
We never sell or rent your personal data to any third party.
We may share data only in these circumstances:
- With buyers/sellers — your display name and WhatsApp number (if provided) are visible on your public listings. You control whether to add a phone number.
- With processors in Section 6 — only as necessary to run the platform.
- Legal requirements — if required by a Kenyan court order, police investigation, or other lawful authority.
- Safety — if we believe disclosure is necessary to prevent serious harm or fraud.
9 Data Retention
- Account data — kept until you delete your account.
- Listings — active listings kept until deleted by you. Expired/sold listings kept 12 months for dispute handling, then deleted.
- Payment records — kept 7 years as required by Kenyan tax law.
- Reports & safety logs — kept 3 years to support investigations.
- Support messages — kept 2 years.
When you delete your account we remove your profile, listings and messages within 30 days. Payment records and safety logs are retained as noted above.
10 Your Rights Under Kenya DPA 2019
Access
Request a copy of all personal data we hold about you.
Correction
Ask us to correct inaccurate or incomplete data.
Deletion
Request deletion of your account and personal data.
Portability
Receive your data in a machine-readable format.
Objection
Object to processing based on legitimate interests.
Restriction
Ask us to restrict processing in certain circumstances.
To exercise any right, email info@jbeecreations.co.ke with subject line "Data Request". We will respond within 21 days as required by the Kenya DPA 2019.
11 Children's Privacy
MNUC Market is intended for users aged 18 and above. We do not knowingly collect data from anyone under 18. If you believe a minor has registered, contact us immediately at info@jbeecreations.co.ke and we will delete the account.
12 Security
- All data in transit is encrypted with TLS (HTTPS).
- Passwords are never stored — we use Supabase Auth which handles hashing and salting securely.
- Database access is restricted by Supabase Row Level Security (RLS) — users can only access their own data.
- API keys and secrets are stored as environment variables, never in source code.
- We conduct periodic reviews of access controls and dependencies.
13 Changes to This Policy
We will notify users of material changes by posting a notice on the platform. Continued use after changes take effect constitutes acceptance of the updated policy.
Version history: v1.0 — January 2025 · v2.0 — June 2026 (current — added Google OAuth section, processor table, rights grid, cookie table, DPA legal basis).
14 Contact & Complaints
If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya at odpc.go.ke.